Apache OpenOffice 4.1.17 fixes 13 flaws: update office PCs

The Apache OpenOffice team has released version 4.1.17, which fixes 13 security flaws. Some of them can be triggered just by opening a harmful file, including Word documents, PDFs and drawing files, and one could lead to the computer being taken over. If any PC in your office still has OpenOffice installed, update it to 4.1.17 or remove it.

What is affected?

All Apache OpenOffice versions up to and including 4.1.16. According to the OpenOffice security bulletin, the flaws include:

• Memory errors when opening crafted PDF files, including encrypted PDFs, which could let an attacker run code.
• Problems reading old Word documents, WMF pictures and DXF drawings.
• A crafted document that can lead to system takeover.
• Documents that quietly load a file from the internet without asking, or read local files through database links.
• A flaw in the Windows installer.
• Documents that show different content in different programs instead of being flagged as damaged.

We have not seen reports of these being used in attacks. Now that the details are public, harmful files can follow, most likely as email attachments.

Is LibreOffice affected?

This bulletin is for Apache OpenOffice. LibreOffice is a separate project with its own updates. If your office uses LibreOffice, keep it on the latest version through Help, then Check for Updates.

What to do

1. On each PC, open OpenOffice and go to Help, then About, to see the version.
2. If it is 4.1.16 or older, download 4.1.17 from openoffice.org and install it over the old version.
3. If nobody uses OpenOffice on that PC any more, uninstall it instead. Old office software left installed is still a risk.
4. Until every PC is updated, tell staff not to open documents, PDFs or drawings from unknown senders.
5. Check shared and older PCs too, such as the reception or warehouse computer.

How SyncTech can help

Many harmful attachments arrive by email. Our email hosting with spam and virus filtering blocks a lot of them before staff see them. If you need help checking which PCs need updates, contact us through our help centre.

Source and credit

We are sharing this news from the Apache OpenOffice project. This summary is written by Synctech in our own words.

• Apache OpenOffice Security Team Bulletin, Apache OpenOffice, retrieved 5 November 2026: https://www.openoffice.org/security/bulletin.html
• CVE-2026-90624: Apache OpenOffice PDF file parsing heap buffer overflow, oss-security mailing list, 3 November 2026: https://www.openwall.com/lists/oss-security/2026/11/03/25 Retrieved 5 November 2026. Apache OpenOffice, LibreOffice, Microsoft Word and Windows are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.